feat(observability): add Prometheus alerting rules and Grafana dashboard (closes #349)

.dockerignore

@@ -0,0 +1,12 @@
+# Root .dockerignore — used when building Docker images with the repo
+# root as build context (e.g., api/Dockerfile needs workspace packages).
+node_modules
+dist
+coverage
+.git
+.env
+.env.*
+!.env.example
+npm-debug.log*
+.next
+*.log

.github/workflows/docker-scan.yml

@@ -61,9 +61,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - context: api
+          - context: .
+            dockerfile: api/Dockerfile
             image: xstreamroll-api
-          - context: app
+          - context: .
+            dockerfile: app/Dockerfile
             image: xstreamroll-app
           - context: xstreamroll-processing
             image: xstreamroll-processing

.github/workflows/release.yml

@@ -41,9 +41,11 @@ jobs:
     strategy:
       matrix:
         include:
-          - context: api
+          - context: .
+            dockerfile: api/Dockerfile
             image: xstreamroll-api
-          - context: app
+          - context: .
+            dockerfile: app/Dockerfile
             image: xstreamroll-app
           - context: xstreamroll-processing
             image: xstreamroll-processing

.github/workflows/security-scan.yml

@@ -123,9 +123,11 @@ jobs:
       matrix:
         include:
           - image: api
-            context: api
+            context: .
+            dockerfile: api/Dockerfile
           - image: app
-            context: app
+            context: .
+            dockerfile: app/Dockerfile
           - image: processing
             context: xstreamroll-processing
 

api/Dockerfile

@@ -1,19 +1,34 @@
+# Build context: repo root (not api/) — required so pnpm can resolve file:
+# workspace dependencies (@xstreamroll/types, @xstreamroll/contract-tests).
 FROM node:20-alpine AS builder
 WORKDIR /app
-COPY package.json pnpm-lock.yaml ./
+
+# ── Workspace package manifests (needed for pnpm file: resolution) ────────────
+COPY package.json ./
+COPY packages/types/package.json packages/types/tsconfig.json ./packages/types/
+COPY packages/types/src/ ./packages/types/src/
+COPY tests/contracts/package.json tests/contracts/tsconfig.json ./tests/contracts/
+# Issue #340: include SQL migration files so the k8s init container can run
+# `node-pg-migrate up -d /app/database/migrations -m sql` without a separate
+# ConfigMap mount. Keeps the runner, schema, and runtime image in lockstep
+# from a single published artifact.
+COPY database/migrations/ ./database/migrations/
+
+# ── API package manifests and install ─────────────────────────────────────────
+COPY api/package.json api/pnpm-lock.yaml api/pnpm-workspace.yaml ./api/
+WORKDIR /app/api
 RUN npm install -g pnpm && pnpm install --frozen-lockfile
-COPY . .
+
+# ── Copy remaining API source and build ───────────────────────────────────────
+COPY api/ ./
 RUN pnpm run build
 
+# ── Production image ──────────────────────────────────────────────────────────
 FROM node:20-alpine
 WORKDIR /app
 RUN addgroup -S appgroup && adduser -S appuser -G appgroup
-COPY --from=builder --chown=appuser:appgroup /app/dist ./dist
-COPY --from=builder --chown=appuser:appgroup /app/node_modules ./node_modules
-# Issue #340: include SQL migration files so the k8s init container can run
-# `node-pg-migrate up -d /app/database/migrations -m sql` without a separate
-# ConfigMap mount. Keeps the runner, schema, and runtime image in lockstep
-# from a single published artifact.
+COPY --from=builder --chown=appuser:appgroup /app/api/dist ./dist
+COPY --from=builder --chown=appuser:appgroup /app/api/node_modules ./node_modules
 COPY --from=builder --chown=appuser:appgroup /app/database/migrations ./database/migrations
 USER appuser
 EXPOSE 3001

api/package.json

@@ -45,6 +45,7 @@
     "prom-client": "^15.1.3",
     "cookie-parser": "^1.4.6",
     "reflect-metadata": "^0.1.13",
+    "rxjs": "^7.8.2",
     "sanitize-html": "^2.17.4",
     "socket.io": "^4.8.3",
     "swagger-ui-express": "^5.0.1",